Port knocking is a stealthy network authentication technique (T1205.001) in which a client sends a specific sequence of connection attempts (or “knocks”) to closed ports on a server. When the correct sequence is received, the server dynamically opens a port or triggers an action, enabling concealed access or communication. Saucepot C2 elevates the port knocking technique to a new level. Instead of using destination ports (DstPorts) in TCP sessions as knock sequences, it leverages source ports (SrcPorts), also known as ephemeral ports. This approach allows data exfiltration even in highly restrictive firewall environments where only a single outbound port, such as port 443, is allowed.
In this DEF CON 33 Red Team Village workshop, attendees will use Saucepot C2 in conjunction with the following MITRE ATT&CK techniques to conduct specific Red Team activities: T1041 Exfiltration Over C2 Channel, T1071.001 Application Layer Protocol: Web, and T1205.001 Traffic Signaling: Port Knocking.